Method for establishing restricted broadcast groups in a switched network

ABSTRACT

Method and apparatus for establishing restricted broadcast groups in a switched network. The method assigns different virtual LAN identifiers (VLAN-IDs) to different subsets of associated end systems or access ports. Tables are maintained for mapping the VLAN-IDs with associated end systems and access ports. When a broadcast packet is received at a first switch, it is encapsulated with a VLAN header, including the VLAN-IDs, and sent out a multicast channel to all other switches in the network (domain). The original packet is sent out the other access ports of the receiving switch for the designated VLAN-IDs. The switches receiving the VLAN packet remove the header and send the original packet out access ports associated with the VLAN-IDs extracted from the header. The method provides a mechanism for forwarding broadcast packets of a protocol not supported by the switching mechanism, as well as multicast packets and unicast packets from undiscovered end systems.

This application is a continuation application under 37 CFR 1.60, ofpending prior application Ser. No. 08/559,738 filed on Nov. 15, 1995 andentitled METHOD FOR ESTABLISHING RESTRICTED BROADCAST GROUPS IN ASWITCHED NETWORK, now U.S. Pat. No. 5,684,800.

FIELD OF THE INVENTION

This invention relates to packet switched data communications networks,and more particularly to an apparatus and method for establishingrestricted broadcast groups known as virtual LANs (VLANs) which providea simple but robust mechanism that allows broadcast and/or multicastpackets to be "flooded" through a switched domain and transmitted onlyto those users or ports defined for a particular VLAN.

RELATED APPLICATIONS

The subject matter of the above application may be advantageouslycombined with the subject matters of the following copending andcommonly owned applications, which are hereby incorporated by referencein their entirety:

U.S. Ser. No. 08/188,238 entitled "Network Having Secure Fast PacketSwitching And Guaranteed Quality Of Service," filed Jan. 28, 1994 byKurt Dobbins et al. now U.S. Pat. No. 5,485,455; and

U.S. Ser. No. 08/187,856 entitled "Distributed Chassis Agent For NetworkManagement," filed Jan. 28, 1994 by Brendan Fee et al., now U.S. Pat.No. 5,522,042.

BACKGROUND OF THE INVENTION

Most data communications networks today rely heavily on shared medium,packet-based LAN technologies for both access and backbone connections.These networks use bridges and routers to connect multiple LANs intoglobal internets. An internet router must be capable of processingpackets based on many different protocols, such as IP, IPX, DECNET,AppleTALK, OSI, SNA and others. The complexities of building networkscapable of routing packets on the global internet using differentprotocols is a challenge for boch vendors and users.

In U.S. Ser. No. 08/188,238 to Dobbins (see related applications above),there is described a new secure fast packet switching (SFPS) technologywhich provides the same or better reliability and security as routers,but with much greater performance and without an increase in cost. TheSFPS system avoids the complexities and costs of providingmulti-protocol routers. Also, the SFPS system provides capabilitieswhich routers do not, such as the ability to create separate logicalwork group LANs on the same physical network and the ability toguarantee a quality of service (QOS) by providing dedicated switchedpaths through the network.

SFPS provides high performance packet switching based on physical layeraddresses such as source and destination MAC IDs--the unique mediumaccess control (MAC) address assigned to each end system by the IEEE.End-to-end connections are determined by a network managementapplication that provides security and best path routing determinationsbased on a number of constraints. By switching packets based only on MAClayer information, network infrastructure remains protocol insensitive.

More specifically, SFPS uses source and destination MAC addresses whichalone, or in combination with an input port on a switch, form a unicue"connection identifier" for any communication exchange betweendesignated end systems. As an example:

input port=2

source MAC address=00:00:1D:01:02:03

destination MAC address=00:00:1D:11:22:33

together form a "tuple" bound to a specific uni-directional flow from asource address to a destination address. All packets that have thistuple are automatically switched according to the operation of the SFPS.

Network infrastructures are built around a core switching fabric, whichprovides the physical paths or routes that allow users to sendinformation to one another. Access to the switching fabric is gainedthrough an access port. Access ports provide several functions--mostimportantly, they provide security and accounting services. End systemssuch as personal computers (PCs), workstations and servers connect to anaccess port using one or more access technologies such as Ethernet,Token Ring, FDDI, or ATM.

In traditional bridge and router devices, each packet is treated as anindependent unit of data which is individually processed by applicationof access and security constraints, as well as path determination. Incontrast, with SFPS this processing is done only on initial probepackets which are decoded, and through use of a central directory of endsystem constraints policy, call attributes, location, paths, quality ofservice, etc., the connection is either rejected or accepted. Ifaccepted, the oath is determined and switches along the path are"programmed" to allow subsequent packets on this "connection" to beswitched. In either case, subsequent datagrams are either switched ordiscarded without having to reapply all of the security and accesscontrol and path determination logic.

The SFPS switching technology may be constructed as: software objectswhich exist in embedded devices as firmware; software objects which arepart of an application on a commercial computer system; applicationspecific integrated circuits (ASIC); or functionally equivalent hardwarecomponents.

It is common for internetworking devices to "route" the protocols that adevice supports, and "bridge" the protocols that are not supported forrouting. In addition, some protocol frames (such as DECs LAT) areactually unroutable. In SFPS switches, there are protocol-specific callprocessors to route protocol-specific broadcast frames (note thatunicast frames can be processed by a "generic" call processor that doesnot decode or translate the frame at all, but instead makes theconnection request based on the source and destination unicast MACaddresses in the frame). However, a problem arises in that an SFPSswitch has nothing equivalent to bridging of multicast and broadcastpackets for non-supported protocols. Thus, until a protocol-specificcall processor is implemented in a switch, the switch must discard anybroadcast or multicast frames it does not understand.

SUMMARY OF THE INVENTION

A method and apparatus are provided for establishing restrictedbroadcast groups within a switching fabric, known as virtual LANs(VLANs). The VLANs provide a simple but robust mechanism for allowingbroadcast and multicast packets to be "flooded" through the switchingfabric and transmitted only to those users or ports defined for aparticular VLAN.

More specifically, the switched network includes a plurality of endsystems and switches connected by links. The switches have access portsconnected to end systems and network ports connected to other switches.Each end system has a unique physical layer address, e.g., MAC address.In accordance with this invention, different virtual LAN identifiers(known as VLAN-IDs) are assigned to different subsets of associated endsystems or access ports. Each access switch maintains a first table formapping VLAN-IDs to associated end systems and/or access ports (the EndSystem/VLAN table). Each access switch also maintains a second table formapping access ports (of associated end systems) to associated VLAN-IDs(the VLAN/Access Port table).

According to a first embodiment, the restricted V-LAN flooding is usedfor broadcast packets of a protocol not supported by the switches. Whenan original broadcast packet (of an unsupported protocol) is received bya first access switch from a first end system, the first switchdetermines and adds a VLAN header to the original data packet to createa VLAN packet. The VLAN header includes designated VLAN-IDs from thefirst table. The designated VLAN-IDs are assigned based on the physicalsource address of the first end system. The first access switch thenForwards the VLAN packet to all other switches on a multicast channel ofpoint-to-point connections between the switches. The first switch alsoforwards the original broadcast packet out the access ports identifiedin the second table for the designated VLANS (except the originatingport).

The other switches receive the VIN packet and extract the designatedVLAN-IDs from the VLAIN header and then forward the original packet outthe access ports, defined in the other switch's second table, for thedesignated VLAN-IDs.

Other embodiments include the designation of a default VLAN-ID whichmaps to all access ports, a reserved VLALN-ID for use with multicastpackets, and restricted flooding for packets directed to an undiscoveredend system. Still another embodiment provides a single or distributednetwork server on the multicast channel (between switches) to handlebroadcast and multicast packets, which embodiment scales better forlarger networks.

More specific methods and a particular apparatus for implementing thepresent invention are described in the following detailed descriptionand drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic illustration of a network topology built with SFPSswitches.

FIG. 2 is a schematic illustration of an SFPS switch.

FIG. 3 is a logical view of an SFPS switch.

FIG. 4, combining FIGS. 4A and 4B is a flowchart showing processing of adata packet by an SFPS switch.

FIG. 5 is a schematic illustration of a network topology including threevirtual networks (VLAN 100, VLAN 5, and VLAN 20) according to thepresent invention.

FIG. 6 shows an end system table for mapping VLAN-IDs to associated endsystems.

FIG. 7 shows a sort table for mapping access ports (of associated endsystems) to associated VLAN-IDs.

FIG. 8 shows one embodiment of a VLAN packet, in which a VLAN header isappended to an original data packet.

FIG. 9 is a schematic illustration of a network topology utilizing adefault VLAN according to the present invention.

FIG. 10 is a schematic illustration of a network topology utilizing adistributed VBUS server according to an alternative embodiment of thepresent invention.

FIG. 11 is a flow chart showing the redirected flow of a broadcast ormulticast packet to the VPUS service.

FIG. 12 is a flow chart showing the call processing performed by theVBUS service.

FIG. 13 is a flow chart showing the channel listening process of theVBUS service.

DETAILED DESCRIPTION The SFPS Network--Switching of Unicast Packet WithGeneric Call Processor and Switching Of Protocol-Sunnorted BroadcastPackets

According to one embodiment, the establishment of VLANs for transmittingboadcast/multicast packets of non-supported protocols is intended foruse in the SFPS switched network described in U.S. Ser. No. 08/188,238.The following is a general description of the operation of switching"unicast" packets on that network, as illustrated in FIGS. 1-4.

FIG. 1 shows a representative network topology built with six securefast packet switches (SFPS) labeled S1-S6 connected by links L. Eachswitch has for example four ports; some ports are labeled A for accessand some are labeled N for network. The end systems are connected to theaccess ports by links L and are labeled "M₋₋₋₋ ". One end system is anetwork management station or server (NMS) M10, which includes aconnection server.

FIG. 2 is a schematic illustration of an SFPS switch 91 having aplurality of ports 92. A host port 93 connects the switch to its hostCPU 90, which may be an i960 microprocessor sold by Intel Corporation.The host CPU is connected to a system management bus (SMB) for receiptand transmission of discovery and other control messages.

FIG. 3 illustrates the internal operation of the switch. The SFPS switch86 includes in ports 80, out ports 81, a connection database 82, alook-up engine 83, and a multilevel programmable arbiter MPA 84. Theswitch 86 sends and receives messages from the host agent 85, whichincludes a management agent 87, a discovery agent 88, and a callprocessing agent 89.

The management agent 87 provides external control of the configurationand operation of the SFPS switch, through the network management system.

The discovery agent 88 provides a mapping of end systems to switchingports through a passive listening (snooping) capability and aregistering of end system addresses and port locations of the hostswitch with a common external directory. Adjacent switches are alsodiscovered and mapped, but this may be done with an explicitswitch-to-switch protocol (nonpassive).

The call processor 89 provides a means for reouesting connections to beestablished between two end systems. Unicast frames are handled by a"generic" call processor which programs the switches based on the sourceand destination MAC addresses. In a case where the source anddestination MAC addresses are not in the packet frame, i.e., usually ina frame that has a broadcast--all hosts--MAC address, a"protocol-specific" call processor (if available) will decode the packetto find source or destination network addresses and use these to mapback to the physical addresses via the external directory. Once the endsystem MAC addresses are known, the protocol-specific call processorwill then request the connection between the end systems. If thebroadcast frame was a probe or address resolution packet (i.e., animplied connection request), the call processor will return a probereply as a "proxy" which gives the destination end system MAC addresses.Subsequently, the source end system can then send packets directly tothe destination based on its MAC address.

FIG. 4 is a flow chart illustrating what happens from the time a datapacket is received on an in port of the switch, until it is sent on thecorrect out port.

Referring to FIG. 4-A in step 300 the host CPU so is initialized. Thehost programs the connection database 82 to send anv "unknown" or"broadcast" connections to the host port (step 301). The switch thenwaits for a packet to arrive (step 302). Once a packet has arrived (step303), the switch extracts the source MAC address, destination MACaddress, and identifies the inbound port on which the packet wasreceived (step 304). The look-up engine 83 checks to see whether thissource-destination pair is already located in the connection database 82(step 305). If it is not found, the packet is given to the host agent 85(step 308). The call processor and the host agent determine whether itis a broadcast destination (step 309). If the answer is yes, aprotocol-specific call processor (if available) decodes the packet tofind the network protocol source and destination addresses (steps310-311). A different protocol decode logic would be provided for eachnetwork protocol. For example, in the IP protocol, if an ARP request isreceived, the call processor would get the target IP address (step 312).It would then ask the external directory for the MAC address of thedestination IP (step 313). In the next step 314, the directory sends theMAC destination address back to the call processor. The call processor89 then asks the connection server (SCS) to set up a connection betweenthe source MAC and destination MAC (step 315). The call processor 89forms an ARP reply packet by putting the destination MAC address insidethe packet (step 316), and the call processor sends a reply to thesource address (step 317). It should be noted that this reply allows thesource end system to update its private mapping of the destination IPaddress to a nonbroadcast MAC address. All subsequent packets to thisdestination IP address will be properly framed with the source anddestination MAC address for which connections will now exist.

Note that if no call processor exists which supports the relevantprotocol, the broadcast packet is dropped (step 321). The presentinvention is a method of handling such packets.

If the packet is not a broadcast packet, it is given to the "generic"call processor (treated as an unknown SA-DA connection--step 318), whichasks the connection server to set up a connection and forward the packet(step 319); the call processor then discards the packet (step 320).

Returning to step 305, if the source and destination MAC pair are foundin the connection database 82, the data packet is sent to the switchoutport(s) 81 defined in the database (step 306). In next step 307, themanagement agent 87 collects statistics regarding transmissions throughthe switch and sends them to the SCS (connection server).

Restricted Broadcast Groups For Non-Supported Broadcast, MultiCast andUnknown Unicast Packets

FIG. 5 illustrates generally a logical view of the present invention forestablishing restricted broadcast groups or virtual LANs (VLANs) withina switched network. The representative network 10 has four SFPS switches11-14, all of the switches being connected by physical links formingpoint-to-point connections 15, and which physical connections togetherform a logical multicast channel 16. The multicast channel 16 connectsthe network ports of all switches. A plurality of end systems 20A-20Lextend from access ports on the various switches 11-14. The end systemsare shown grouped into different subsets known as virtual LANs 17, 18and 19, which are given VLAN identifiers VLAN 100, VLAN 5, and VLAN 20,respectively. As shown in FIG. 5, "VLAN 20" includes end systems 20B,20C, 20J and 20K. "VLAN 5" includes end systems 20D, 20G, 20H and 20L."VLAN 100" includes end systems 20A, 20B, 20D, 20F, 20H and 20I.

During a discovery time, as each switch 11-14 is discovered, it is putin a point-to-point connection that connects all SFPS switches. Thisforms the multicast channel 16 which all switches use betweenthemselves.

Also during the discovery time, each switch 11-14 discovers itsassociated end systems (i-e., switch 11 discovers end systems 20A, 20B,20C) and enters these end systems in a common directory which assignsVLAN-IDs to the end systems. The directory returns a mapping of VLAN-IDsand associated end systems, which mapping each switch uses to build twointernal tables: a first table that lists the VLAN-ID for each endsystem (the End System/versN Table--see FIG. 6), and a second table thatdefines a port mask for each VTAN-ID (the VLAN/Access Port Table--seeFIG. 7).

During real time operation of the system, a first switch (for exampleswitch 11) receives a broadcast or multicast packet that it cannotprocess with a protocol-specific call processor. The switch willencapsulate the original packet and insert a VTAN header containing alist of VLAN-IDs for the source end system (see FIG. 8), before floodingthe encapsulated (VLAN) packet out the multicast channel 16 to all otherswitches. For example, if first switch 11 receives a broadcast packetfrom first end system 20B, switch 11 returns from its end system table(FIG. 6) that VLAN 100 and VLAN 20 are associated with source end system20B. First switch 11 will insert VLAN 100-and VLAN 20 into the VLANheader (FIG. 8). In addition, first switch 11 determines the port masksfor VLAN 100 and VLAN 20 from its port table (FIG. 7), and then sendsthe original broadcast packet out all access ports of the first switchin VLAN 100 or VLAN 20 (except for the source port 2); in this case, theoriginal packet is sent out access port 1, which connects to end system20A, also in VLAN 100, and out access port 3, which connects to endsystem 20C, also in VLAN 20.

As each of switches 12, 13 and 14 receive the VLAN packet on multicastchannel 16, they strip off the encapsulated VLAN header and look up intheir respective VLAN/Access Port table for any associate mapping toVLAN 100 and VLALN 20. Switch 12 determines in its port table that ithas associated access ports to end systems 20D and 20F designated forVLAN 100. Similarly, switch 13 determines from its port table that ithas associated access ports to end systems 20H and 20I for VLAN 100.Switch 14 determines from its port table that it has associated accessports to end systems 20J and 20K for VLAN 20. The original packet isthus transmitted out the access ports to end systems 20D, 20F, 20H, 20I,20J and 20K.

The following describes the changes and additional functionalityrequired of the SFPS access switches to support the establishment ofVLANs for multicast and broadcast packets. Switches with only networkports continue to function as described in prior U.S. Ser. No.08/188,238 to Dobbins et al.

The Switch-To-Switch Multicast Channel

Each SFPS switch supports the multicast channel 16 by having aconnection in each switch that connects it to all other switches in thenetwork (or within a subsection of the network, such as a domain). Thisis in essence a point-to-multipoint connection in each switch. It shouldbe noted that this multipoint connection is only between the switchesthemselves, which scales better than having a multipoint connectionbetween all users (end systems).

A connection server (i.e., M10 in FIG. 1), which includes a commondirectory of all switches, has the responsibility to program themulticast channel connection each time a new switch joins or leaves thetopology, i.e., such a change may be detected by neighbor advertisementsignals sent by the switches.

The End System/VLAN Table (FIG. 6)

Each switch that has an access port maintains a table of end systemsheard on each access port, and a list of VLANs to which each end systembelongs. An end system can belong to more than one VLAN at any giventime.

The assignment of VLAN-IDs may be accomplished in several ways. First,the VLAN-IDs may be maintained by a common directory. For example, aseach end system is discovered by an access switch, it is registered witha common directory of end systems for the entire network, and thedirectory then returns a list of VLAN-IDs to the access switch with the"End System Discovery Message ACK." Alternatively, a managementapplication may administratively assign the VLLAN-IDs, and manage theend system and port tables in the switch. As a further alternative, anaccess switch may send a Resolve signal to a directory, which directorythen returns a mapping of VLAN-IDs for an associated end system.

The VLAN/Access Port Table (FIG. 7)

Each switch having an access port maintains a port table which mapsVLANs to associated access ports. This table may be filled indynamically through the implicit mapping of VLANs to end systems. Eachtime a VLAN is mapped to an end system, it is automatically inserted ina port-mapping entry for the source port on which the end system islocated. Ports, like end systems, can belong to more than one VLAN atany given time; tie port's VLAN mapping strictly depends upon the VLANof the end systems on it. The out ports for each VLAN entry in the tableessentially define the flood mask for the access ports.

The Default VLAN-ID

A default VLAN-ID (VLAN-ID=1) may be used to map an end system to a VLANwhen no VLAN-ID had been administratively assigned. The default VLAN isa special case which maps to all access ports. This allows flooding outall ports when no VLAN is defined. For example, FIG. 9 illustrates anetwork of four switches 30, 31, 32, 33, connected by multicast channel35, prior to assignment of any specific VLAN-IDs such that all endsystems fall within a default VLAN 36.

The VLAN Call Processor

The VLAN call processor is essentially a default call processor forbroadcast/multicast packets for which no protocol-specific callprocessor exists. For example, an ARP call processor would be able todecode an ARP broadcast message.

The VLAN call processor would take any packet it receives and thenencapsulate the broadcast/multicast packet in a header, the headercontaining a list of VTAN-IDs on which the packet belongs. The VLAN-IDlist may be determined by using the source MAC address of the originalpacket and doing a look-up in the end system table. In this example,VLAN-IDs are determined based on the source rather than the destination.Once this encapsulated packet is formed, it is then forwarded on themulticast channel to all other switches. The original packet would alsobe given to the local forwarder.

The Local Forwarder

Each switch has a process that listens on the multicast channel 16. Thisprocess is responsible for processing any encapsulated frames (VLANpackets) sent from other switches. When the VLAN packet is received, itis stripped of its VLAN-ID list in the header. For every entry in theVLAN-ID list, the local port table is searched for a matching entry. Thelocal forwarder then forwards the original data packet out any portsthat are mapped to the VLAN-ID. If the VLAN-ID is the default VLAN-ID(=1), then the original packet is flooded out all access ports on theswitch. If no VLAN-IDs match, then the packet is discarded.

The Central Connection Server And Common Directory

A central connection server programs the point-to-multipoint connectionsbetween all of the SFPS switches, as there is no provision in eachswitch to do so (see M10 in FIG. 1). Thus, any time the connectionserver "discovers" a change in a switched topology, it has to reprogramthe multicast channel between the switches.

The server accesses a common directory for mapping end systems toVLAN-IDs. A management application may provide this on the front end,and in addition provide for changes to the mapping in the directoryitself and in any switches that have been informed of the mapping. Anyend system not defined with a VLAN would default to VLAN-1.

If the VLAN assignment is done inside an End System Discovery MessageACK, then a new TLV list is added to the message. This functions similarto an "alias" field in which more than one are allowed since multipleVLANs could be returned. If the VLAN assignment is done with Resolvemessages, then only a new TAG type has to be assigned since the messagesupports returning multiple resolutions. The semantics would be "resolvethis end system to its VLAN-IDs." If the assignment was done completelyout of band, then no signalling changes would be required.

Reserved VLAN-IDs

In the previous embodiment, broadcast and multicast packets arepropagated through the switches based on the VLAN-IDs to which thesource belongs. In some cases, mostly with multicast frames, it may bedesirable to map a VLAN to the destination, e.g., OSPF packets.

This may be accomplished by allowing the switches to support"well-known" VLANs without any run-time assignment. If a switch receivesg packet destined for a reserved VLAN, it would encapsulate it and setthe VLAN list without mapping it to the end system table. The packetwould then be forwarded out the multicast channel and any switchessupporting the reserved VLAN (or having heard a reserved VLAN-typepacket) would flood the original packet out.

Unicast Flooding

VLANs may be supported for unicast frames, for example if a callprocessor has not yet discovered the end system. This works similar tothe broadcast/multicast operation except that instead of mapping theoutports at each flooding switch, each switch would look up thedestination unicast address in the end system table and send theoriginal packet out the port on which the end system belongs.

VBUS Service

Since point-to-point connections between switches does not scale well,in an alternative embodiment each switch has a connection to a single(or distributed) server in the network which will forward broadcast andmulticast packets. This service, referred to as the VirtualBroadcast/Unknown Service (VBUS), is distributed into all SFPS switchesin a first implementation as illustrated in FIG. 10. Switches 61, 62,63, 64 are connected by multicast channel 66, and each switch includesthe distributed VBUS service 65.

FIG. 11 illustrates the redirected flow of data packets for the VBUSservice. When a first switch receives a broadcast or multicast packet(step 40), it first determines whether the packet was received on anaccess port (step 41). If no, the packet is discarded (step 47). If yes,the packet is passed to a redirector queue (step 42), and if a callprocessor supports the packet type (step 43), the redirector deliversthe packet to the protocol-specific call processor (step 44). If not,the packet is passed to the VBUS call processor (step 45). Theredirector queue then handles the next packet on the queue (step 46).

FIG. 12 illustrates the operation of the VBUS call processor. Eachswitch listens for source addresses heard on each access port (step 48).The call processor then updates the End System/VLAN table with theaccess port and end systems heard (step 49). The call processor thencreates a signal entry (step 50) which is sent to the connection server(step 51), which formats a response to the signal (step 52). Theconnection server returns a signal with the associated VLAN list, whichis received by the call processor (step 53). The call processor gets theassociated access ports from the VLAN/Access Port Table (step 54) andsends out the original packet on the associated access ports (step 55).The call processor gets the network ports from the switch's connectiontable (step 56), encapsulates the packet with the VLALQ header (step57), and sends the encapsulated packet out the network ports to theother switches (step 58). The call processor then deletes the signalentry (step 59) and returns to start (step 60).

FIG. 13 illustrates the operation of the VBUS channel listener. When apacket is received on a network port (step 70), it first determineswhether there is a known connection in the connection database 82 (step71), and if so, it forwards the packet out the appropriate outport (step72). If there is no connection, it determines whether this is a VBUSpacket (step 73). If no, it returns to the beginning. If it is a VBUSpacket, the packet is handed to a VBUS port (step 74) and the VLAN listis extracted from the header (step 75). The access ports are obtainedfrom the VLAN/Access Port Table (step 76), and the encapsulation headerremoved from the packet (step 77). The original packet is then sent outthe associated access ports defined in the table (step 78).

In one embodiment, the switch provides a MIB interface to allow anexternal application to assign VLAN-IDs to access ports and/or endsystems. The simplest model is to progam VLAN-IDs to the switched portsonly; under this model, the administration is simpler and the VLANassignment to end systems is implied by the switched port to which theend systems are physically connected. A more robust model would map theVLAN-IDs from policy work group definitions.

The application interface may be provided with an SNMP (Simple NetworkManagement Protocol) MIB (management information base) which allows asimple interface to program connections via a single SiNTMP set message.The MIB interface provides the following semantics:

(map, unmap) SFPS VLAN-ID! inport! userMAC!

This verb set assigns (and removes) a user MAC address and switch portto (or from) a specific VLAN.

(map-port, unmap-port) SFPS VLAN-ID! inPort!

This verb set assigns (and removes) a switch port to (or from) aspecific VLAN. The switches provide managed objects accessible by theMIB which are all accessed with standard SNMP get, get next, and setmessages.

In one embodiment, a VLAN status table is provided. This table allows anentire VLAN to be enable or disabled regardless of the number of user orswitch ports assigned to the VLAN in the switch. Thus, it is possible toshut off a particular VLAN inside a particular switch without having toadminister each individual switch port or end system.

One goal of the VBUS service is to require minimal support from thenetwork server. The only server requirement is providing each switchwith a connection to all other switches in the network (domain), whichin effect provides the multicast channel for flooding VLAN packets.

While there have been shown and described several embodiments of thepresent invention, it will be obvious to those skilled in the art thatvarious changes and modifications may be made therein without departingfrom the scope of the invention as defined by the appending claims.

We claim:
 1. A method of restricted flooding of a data packet, of one ofa broadcast, multicast and unknown destination type, in a switched datacommunications network, the network including a plurality of end systemsand switches connected by links, the switches having access portsconnected to end systems and network ports connected to other switches,the method including steps of:a. assigning at least one identifier to arespective subset of end systems; b. mapping the at least one assignedidentifier to an access port attached to at least one end system in therespective subset of end systems; and c. when the data packet isreceived from a source end system at a receiving access port of a firstswitch:i) determining one or more identifiers associated with the sourceend system; ii) encapsulating the data packet by adding a header withthe one or more determined identifiers; iii) forwarding the encapsulateddata packet to all or a subset of other switches in the network; and iv)determining if at least one access port other than the receiving accessport on the first switch is associated with the one or more determinedidentifiers and forwarding the data packet out the at least onedetermined access port.
 2. The method as recited in claim 1, furtherincluding steps of:d. when the encapsulated data packet is received at asecond switch with access ports:i) stripping the header from theencapsulated data packet and determining the one or more encapsulatedidentifiers in the header of the encapsulated data packet; ii)determining if at least one access port of the second switch isassociated with the one or more encapsulated identifiers; and iii)forwarding the data packet out the at least one determined access portof the second switch.
 3. The method as recited in claim 2,including:listening to end systems heard on respective access ports ateach switch and maintaining the end systems heard and their respectiveaccess ports in a mapping table at the respective switch; and uponreceipt of a unicast packet for a destination end system unknown to thefirst switch, completing step c for the unicast packet and then at thenext switch reviewing the mapping table for the respective access portfor the destination end system and forwarding the packet out therespective access port.
 4. The method as recited in claim 1, wherein ifin step c(iv) no other access port is determined, discarding the datapacket.
 5. The method as recited in claim 1, wherein step b includessteps of:each switch maintaining a first table for relating the at leastone assigned identifier to the end systems of the respective switch; andeach switch maintaining a second table for relating the access ports ofthe respective switch to assigned identifiers.
 6. The method as recitedin claim 5, wherein step c.i) includes a step of:reviewing the firsttable for the one or more identifiers associated with the source endsystem.
 7. The method as recited in claim 6, wherein step c.iv) includesa step of:reviewing the second table for an access port associated withthe one or more determined identifiers.
 8. The method as recited inclaim 7, wherein the assigned identifier is a virtual LAN identifier. 9.The method as recited in claim 1, wherein the received data packet is ofa protocol not supported by a protocol-specific call processor in thefirst switch.
 10. The method as recited in claim 1,including:maintaining a common registry of assigned identifiers.
 11. Themethod as recited in claim 10, including:registering each end system oraccess port with the common registry, and returning a list of assignedidentifiers from the common registry to each switch for the end systemsor access ports of the respective switch.
 12. The method as recited inclaim 10, including:sending a signal from the first switch to the commonregistry to resolve an end system or access port to its assignedidentifiers.
 13. The method as recited in claim 1, including:maintainingthe mapping at each switch for the access ports of the respectiveswitch.
 14. The method as recited in claim 1, including:prior toassigning an identifier to a specific end system maintaining a defaultidentifier for that specific end system which maps to predeterminedaccess ports.
 15. The method as recited in claim 1,including:maintaining a multicast channel of connections between all ora subset of switches and wherein step c(iii) comprises forwarding theencapsulated packet on the multicast channel.
 16. The method as recitedin claim 15, wherein the channel includes:a point-to-multipointconnection from each switch to all other switches in the network. 17.The method as recited in claim 1, wherein step c(iii) includes providinga distributed service in the switches for forwarding the encapsulateddata packet.
 18. The method as recited in claim 1, wherein theidentifier is assigned based on a policy work group definition.
 19. Themethod as recited in claim 1, including:maintaining at least one mappingtable at each switch for performing the mapping step.
 20. The method asrecited in claim 19, including:listening to end systems heard onrespective access ports at each switch and maintaining the end systemsheard and their respective access ports in the mapping table at therespective switch.
 21. The method as recited in claim 18,including:assigning a reserved identifier without limitation as to endsystem and access port.
 22. The method as recited in claim 1,including:maintaining a Management Information Base (MIB) interface ateach switch for programming at least one mapping table, the mappingtable being used to perform the mapping step.
 23. The method as recitedin claim 22, wherein:using a Simple Network Management Protocol (SNMP)set message for maintaining the mapping table at each switch.
 24. Themethod as recited in claim 1, including:maintaining a status table ateach switch for enabling and disabling the respective subset.
 25. Aswitch for restricted flooding of a data packet, of one of a broadcast,multicast and unknown destination type, in a switched datacommunications network, the network including a plurality of end systemsand switches connected by links, the switch having access portsconnected to end systems and network ports connected to other switches,the switch comprising:means for assigning at least one identifier to arespective subset of end systems; means for mapping the at least oneassigned identifier to an access port attached to at least one endsystem in the respective subset of end systems; means for receiving thedata packet from a source end system at a receiving access port; meansfor determining one or more identifiers associated with the source endsystem; means for encapsulating the data packet by adding a header withthe one or more determined identifiers; means for forwarding theencapsulated data packet to all or a subset of other switches in thenetwork; means for determining if at least one access port on the switchis associated with the one or more determined identifiers; and means forforwarding the data packet out the at least one determined access portother than the receiving access port.
 26. The switch as recited in claim25, further comprising:means for receiving an encapsulated data packeton a network port of a receiving switch; means for stripping the headerfrom the encapsulated data packet to determine a stripped data packet;means for determining the one or more encapsulated identifiers in theheader of the encapsulated data packet; means for determining if atleast one access port of the receiving switch is associated with the oneor more encapsulated identifiers; and means for forwarding the strippeddata packet out the at least one determined access port of the receivingswitch associated with the one or more encapsulated identifiers.
 27. Ina switched communications network including a plurality of end systems,a method of restrictive flooding of a data packet selected from thegroup consisting of a broadcast packet, a multicast packet, and anunknown destination packet of a protocol not supported by a callprocessor in an access switch which receives the data packet, the methodcomprising:assigning at least one identifier to a respective subset ofend systems; mapping the at least one assigned identifier to an accessport of the access switch attached to at least one end system in therespective subset of end systems: upon receipt of the data packet at theaccess switch, encapsulating the data packet with the at least oneindentifier assigned to a source end system of the data packet andforwarding the encapsulated packet to all or a subset of other switchesin the network, and sending the original data packet to access portshaving the at least one identifier; and upon receipt of the encapsulatedpacket at a receiving switch, de-encapsulating the packet and forwardingthe de-encapsulated packet to the access ports having the at least oneidentifier.